Vendor: Cisco. Exam Code: Exam Name: ESFE Cisco Security Field Engineer Specialist. Version: Demo

Transcription

1 Vendor: Cisco Exam Code: Exam Name: ESFE Cisco Security Field Engineer Specialist Version: Demo

2 Question No : 1 In the C-160's factory default configuration, which interface has ssh enabled by default on the address? A. Data 2 B. Data 1 C. None. SSH must be first enabled through the console. D. Management Answer: B Question No : 2 Refer to the exhibit. Based on the Add Condition menu which of listed file attachments will be matched? (Choose two.) A. A.pdf attachment B. A. msi attachment that has had its file extension changed to.pdf C. A. pdf attachment that has had its file extension changed to.exe. D. A. exe attachment. Answer: B,D 2

3 Question No : 3 How can C-Series archived reports be retrieved? A. They cannot be retrieved, since the reporting information is deleted and data is collected for the next reporting period. B. Archived reports are retrieved by going to ftp://mgmt.<c-series host name>.com C. Archived reports can be retrieved through the GUI by going to: Monitor > Archived Reports Answer: C Question No : 4 Which of the following choices shows the GUI menu path for importing a content dictionary to be used in an Incoming content filter? A. Mail Policies > Dictionaries > Add Dictionary B. System Administration > Configuration Directory > Import Dictionary C. Mail Policies > Dictionaries > Import Dictionary D. Mail Policies > Incoming Mail Policies > Dictionaries > Import Dictionary Answer: C Question No : 5 You have finished installing a C-160 that is designed to filter incoming and relay outgoing mail for the mail server exchange.bravo.com. This is a one armed installation. For some reason, outgoing mail cannot be delivered. According to the mail log, what is the most likely problem? 3

4 A. exchange.bravo.com needs to be configured in the RAT B. exchange.bravo.com needs to be configured on the RELAYLIST C. An SMTP route needs to be configured for exchange.inside.com D. The mail server needs to point to a private listener. E. exchange.bravo.com needs to be removed from the SUSPECTLIST Answer: B Question No : 6 Which of the following filters can only be applied to outbound messages? A. Anti-Virus B. DLP C. Outbreak D. Anti-Spam Answer: B Question No : 7 Which of the following parameters are used by the Anti-Spam engine? (Choose three.) A. The number of recipients in the RCPT TO list. B. Analysis of image content using optical character recognition C. The characteristics of the message (random dots, multiple colors) D. The reputation of URLs in the message E. The sending mail domains reputation Answer: C,D,E Question No : 8 Which one of the following cannot be performed on the M-Series, when using it to support a C-Series? 4

5 A. Centralized message tracking B. Centralized spam quarantining C. Centralized Configuration Management D. Centralized Reporting Answer: A Question No : 9 You have established connectivity to a factory default C-160 through the CLI, What command will allow you to change an interfaces speed and duplex? A. ifconfig B. interfaceconfig C. etherconfig D. mediaccnfig Answer: C Question No : 10 By default, the outgoing mail will be scanned by which one of the following? A. Anti-Spam B. Anti-Virus C. Outbreak Filters D. Reputation Filters Answer: B Question No : 11 Refer to the wizard screenshot. 5

6 In the system setup wizard, when configuring the Data 1 interface to accept mail from the internet, which of the following will be displayed in the SMTP banner? A. Destination B. Domain C. Fully Qualified Hostname D. IP address Answer: C Question No : 12 An organization has a single mail domain; exchange.bravo.com. Within this domain are several departments finance, accounting etc. Alan and Brian are in finance. Alice and Brenda are in accounting. You need to suggest a method for applying mail policies to members of finance that are different than members of accounting. What is the best solution? A. On the C-Series, create individual mail policies for each department and enter their mailbox addresses into their corresponding department policy. B. Move the members of accounting onto a different mail server; notes.bravo.com. and define its mail domain in the RAT and SMTP route table. Now Alice will have the mailbox alice@notes.bravo.com. Next create a mail policy for accounting that matches on this new domain and applies restrictions for accounting. C. Define an employee's department membership in a group attribute of LDAP directory. On the C-Series, create individual mail policies for each department that reference group membership through an LDAP group query, and then apply that department's restrictions. D. On the C-Series, create individual content filters for each department. Create a content dictionary for each department that contains their mailbox addresses. Reference these 6

7 dictionaries to determine a match on that department member and then apply the appropriate department restrictions in the action menu. Answer: C Question No : 13 When setting up a mail flow policy, two of the choices for connection behavior are "ACCEPT" and "RELAY". Select the following choice that describes the difference between these. A. ACCEPT will check the "mail from" field against the HAT. B. ACCEPT will check the "rcpt to" field against the HAT. C. ACCEPT will check the "rcpt to" field against the RAT D. ACCEPT will check the "mail from" field against the RAT. Answer: C Question No : 14 A large enterprise customer, whose domain name is csu.edu, needs to create a report on incoming and outgoing mail from either internal domains math.csu.edu or hum.csu.edu. How will you advise them? A. Configure localized reporting and create scheduled domain reports. B. Configure localized reporting and create scheduled outgoing senders: domains report. C. Configure centralized reporting and create scheduled domain reports. D. Configure localized reporting and create scheduled executive summary report. Answer: C Question No : 15 How does a customer report s that are falsely classified as spam and quarantined by the C-Series appliance? (Choose two.) A. Send the spam as an attachment in RFC 822 format to spam@access.ironport.com 7

8 B. Send the spam as an attachment in RFC 822 format to C. Use the Submission plugin to submit this back to IronPort. D. Open a case for this problem and attach the spam to an RFC 822 format.. Answer: B,D Question No : 16 Which of the following CLI commands will configure the default route? A. setgateway B. setdefaultroute C. ip route Answer: A Question No : 17 Which of the following RAT entries will accept mail for example.com and all of its subdomains? Select two. A. example.com B..example.com C. * example.com D. * *.example.com Answer: A,B Question No : 18 One of the items on the Pre-Install Worksheet is "Create DNS records for default the hostname". Which of the following sections in the work sheet contains this item? A. Action Items B. Contact Information C. Current Topology D. Functionality Desired 8

9 Answer: A Question No : 19 In the IronPort C-Series, which of the following control the SMTP conversation? (Choose two.) A. Message Filters B. Outbreak Filters C. Anti-Virus D. Content Filters E. Host Access Table F. Recipient Access Table G. IronPort Anti-Spam Answer: E,F Question No : 20 DRAG DROP Match the following report types with their definition. 9

10 Answer: 10

11 Question No : 21 CORRECT TEXT You are configuring an accept query on the C-Series appliance using Open LDAP. Create an accept query string based on the record that is highlighted in the directory. Answer: (mail={a}) 11

12 Answer: Question No : 22 When a Bypass Receiving Control is enabled for a RAT entry, which function is bypassed? A. LDAP Accept Query B. Mail Plow Policies: Max. Recipients Per Hour Code C. Reputation Filtering D. Reverse DNS Lookup Answer: B Question No : 23 When configuring CRES, where do you enable read receipts? A. In the content filter condition menu B. In the encryption profile C. In the mail policy D. In the content filter action menu Answer: B Question No : 24 CORRECT TEXT 12

13 You are performing a test of the IronPort Anti-Spam. In order to trigger the anti-spam engine for positive spam, what string must follow the x-advertisement? Enter your answer in lowercase. Answer: spam Question No : 25 Using default settings, what describes the difference between rating suspect and positive spam? A. Suspect spam is matched into the SUSPECTUST, where as Positive spam matches on the BLACKLIST. B. Suspect spam is scored between 50 and 74 and positive is 75 or greater. C. Suspect spam has a reputation score between -1 and -3 and positive is between -3 and -10. D. Suspect spam is scored between 50 and 89 and positive is 90 or greater. Answer: D Question No : 26 Refer to the exhibit. You need to configure an LDAP profile based on the directory. What Base DN will provide an efficient search on all of the users in the alpha.com domain? 13

14 A. DC=wsa,DC=train B. DC=train C. OU= users, OU=alpha.com,DC=w$a,DC=train D. OU=alpha. com,dc=wsa,dc=train E. CN=alanalpha,OU=uscrs,OU=alpha.com,DC=wsa,DC=train Answer: C Question No : 27 Refer to the exhibit. You have finished an installation, but the customer cannot receive mail from a business partner. Based on the mail log, how should you explain this to the customer? How can you allow this mail to be accepted into the customer's domain? A. Have their business partner contact IronPort support to adjust their reputation score. B. The business partner's MTA has been blocked based on their reputation. Adjust the settings on the blacklist from -10 to to -10 to The suspectlist will scan this domain for spam C. Allow mail delivered from this site by changing the RAT settings from moderate to conservative. D. The business partner's MTA has been blocked based on their reputation. Suggest whitelisting their partner's domain, but caution them about anti-spam being disabled. Answer: D Question No : 28 Which one of the following choices describe the difference between private and public listeners? A. The connection behavior for a public listener will always be to relay the messages. A private listener will always have an accept connection behavior, which mean that it will check the RCPT TO field of the message against the listener's RAT before delivering the message. 14

15 B. The public listener receives connections from many hosts and directs messages to a limited number of recipients defined in the RAT. A private listener receives connections from a limited number of hosts, defined in its HAT, and directs them to many recipients. A public listener can function as a private by configuring a relay list. C. A public listener will accept and forward all of its incoming mail based on the reputation scores of public IP addresses. A private listener uses only private IP addresses defined in its relay list to accept and deliver outgoing mail. D. Public and private listeners are configured on the Data 1 and Data 2 interfaces respectively. A private listener accepts and forwards outgoing mail, and public listener accepts and forwards incoming mail. Their roles cannot be interchanged. Answer: B Question No : 29 Refer to the exhibit. After an installation, some configuration mistakes were performed that prevented delivery. According to the mail log, what is the most likely problem? A. exchange.bravo.com needs to be configured in the RAT B. An SMTP route needs to be fixed for exchange.inside.com exchange.bravo.com needs to be removed from the SUSPECTUST. C. exchange.bravo.com needs to be configured on the RELAVUST. D. No configuration problem. Just too many messages received by the mail server exchange.bravo.com thus causing them to be queued. 15

16 Answer: C Question No : 30 CORRECT TEXT You are configuring a group query on the C-Series appliance using Open LDAP. The two pictures of the directory have the names of the attributes highlighted that need to be searched on in this group query. Create the query string for this group query Answer: (&(memberof={g})(mail={a})) Answer: 16

17 Question No : 31 How do you check the time remaining on feature keys? A. Click on System Admin > Feature Keys B. Click on System Admin > Feature Key Settings C. Click on Mail Policies > Signing Keys D. Click on Monitor > System Status Answer: A Question No : 32 Refer to the exhibit. Can the next step be to configure the encrypt action in a content filter? A. No. First you need to commit your changes, and click Provision. B. Yes. CRE5 has been added, The next step is to configure the outgoing mail policy. C. Yes. CRES has been added, The next step is to create the content filter. D. No. First you need to click the provision button. Answer: A 17

18 Question No : 33 In the DLP Policy Manager, you have changed the "Action Applied to Messages:" from the default setting to "drop" for those messages w at medium severity? A. Deliver B. Quarantine C. Encrypt D. Drop Answer: A Question No : 34 Refer to the exhibit. Based on the LDAP directory, what attribute names contain the value brian exchange.bravo.com? (Choose two.) A. samacccountname B. mailrcuting Address C. userprincipalname D. mail E. maillocaladdress Answer: B,D 18

19 Question No : 35 In a "one armed installation" using a single listener, how would the system differentiate between incoming and outgoing ? A. Mail flow direction is determined by using the source IP address. B. Mail flow direction is determined by the type of listener, public verses private. C. Mail flow direction is determined by the "Recipient to" field in the SMTP envelope. D. Mail flow direction is determined by the "Mail From" field in the SMTP envelope. Answer: A Question No : 36 CORRECT TEXT You are performing a test of the IronPort Anti-Spam engine. In order to trigger the antispam engine for suspect spam, what is the value of the x-advertisement header needs to be added to the message? Enter the string in lowercase Answer: spam Question No : 37 One of the items on the Pre-Install Worksheet is "Base DN". Which of the following sections in the work sheet contains this item? A. Network Settings B. Firewall Rules C. Mail Information D. Authentication Answer: D Question No : 38 A new C-160 has been delivered and needs to be configured. What subnet and C-Series interface does your laptop need to be configured on? 19

20 A. Data /24 B. Data l /24 C. Data /24 D. Data l /24 Answer: B Question No : 39 Your customer has several DLP policies enabled such that policy order effects the operation. In which menu is the order of the DLP policies changed? A. Mail Policies > DLP Policy Manager, edit policy order B. Security Settings > RSA DLP > edit policy order C. Mail Policies > Outgoing Mail Policies > DLP, edit order D. Mail Policies > Mailflow policies, edit policy order Answer: A Question No : 40 At what point in the SMTP conversation can the SMTP client send message headers? A. Between MAIL FROM and RCPT TO B. Between RCPT TO and DATA C. Between DATA and a period "." on a single line D. Between HELO and MAIL FROM Answer: C Question No : 41 DRAG DROP Match only the following default sender groups with their default senderbase reputation scores. 20

21 Answer: Question No : 42 21

22 In the default settings, which of the following sender groups will match on a reputation score of +2? A. SUSPECTLIST B. BLACKLIST C. RELAYUST D. UNKNOWNUST E. WHITEUST Answer: D Question No : 43 Which of the following types of DNS records deals with mail delivery for a specific domain? A. TXT B. MX C. PTR D. A Answer: B Question No : 44 By default, how do Outbreak filters avoid quarantining false positives? A. All false positives must be quarantined until a Virus signature is received so that they can be checked. B. False positives are released as updates provide a better description of suspected attachment. C. Positive matches are not quarantined. They are dropped. D. False positives do not occur as the Anti-Virus engine will check the signature against the incoming mail. Only positive matches against the signature are quarantined for checking later on. Answer: B Question No : 45 22

23 How does a customer report spam that gets through the C-Series appliance? (Choose two.) A. Send the spam as an attachment in RFC 822 format to spam@access.ironport.com B. Use the Submission plugin to submit this back to IronPort. C. Open a case for this problem and attach the spam to an RFC 822 format.. D. Send the spam as an attachment in RFC 822 format to ham@access.ironport.com Answer: A,B Question No : 46 DRAG DROP Order the following (applicable) steps so that McAfee is enabled as the second of two antivirus engines. Assume that this follows the system setup wizard. Answer: 23

24 Question No : 47 DRAG DROP The following ate steps for registering a Recipient with CRES. Place them in the correct order. Answer: 24

25 Question No : 48 During system setup, how are scheduled reports handled? A. By default scheduled reports are sent to the alert recipient specified in the system setup. B. Scheduled reports are only configured after system setup. C. The recipient for scheduled reports can be different than the alert recipient and scheduled reports can be configured during system setup or afterwards. Answer: B Question No : 49 Which of the following security features ate enabled for outgoing mail by default? A. Sophos Anti-Virus B. Outbreak filters C. MCAfee Anti-Virus D. bounce verification E. IronPort Anti-Spam Answer: A Question No : 50 DRAG DROP 25

26 Match each of the following SMTP server response codes with its definition. Answer: 26

27 To Read the Whole Q&As, please purchase the Complete Version from Our website. Trying our product! 100% Guaranteed Success 100% Money Back Guarantee 365 Days Free Update Instant Download After Purchase 24x7 Customer Support Average 99.9% Success Rate More than 69,000 Satisfied Customers Worldwide Multi-Platform capabilities - Windows, Mac, Android, iphone, ipod, ipad, Kindle Need Help Please provide as much detail as possible so we can best assist you. To update a previously submitted ticket: Guarantee & Policy Privacy & Policy Terms & Conditions Any charges made through this site will appear as Global Simulators Limited. All trademarks are the property of their respective owners. Copyright , All Rights Reserved.